/**
 * @module identity/sso/sso-types
 *
 * Core types and interfaces for extensible SSO (OAuth2) authentication.
 */

export type SsoProviderId = 'google' | 'github';

export interface SsoProviderClientConfig {
    providerId: SsoProviderId;
    clientId: string;
    authUrl: string;
    redirectUri: string;
    scope: string;
}

export interface SsoProviderServerConfig {
    providerId: SsoProviderId;
    clientId: string;
    clientSecret: string;
    tokenUrl: string;
    userInfoUrl: string;
    jwksUrl?: string;
}

export interface SsoServerConfig {
    /** Server's private KDF secret used to derive server-delegate keystones. */
    ssoServerKdfSecret: string;
    /** Server's private session encryption secret. */
    sessionSecret: string;
    /** Map of active OAuth2 providers. */
    providers: Partial<Record<SsoProviderId, SsoProviderServerConfig>>;
}

export interface OAuthUserInfo {
    /** Unique identity key combining provider and sub ID (e.g., `google:107632...`). */
    providerKey: string;
    providerId: SsoProviderId;
    /** Unique user ID within the provider. */
    sub: string;
    email?: string;
    name?: string;
    picture?: string;
}